The WordPress WP HTML Mail plugin for personalized emails is vulnerable to code injection and phishing due to XSS.
Threatpost